p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/src/setup/remote-actions.ts

@@ -0,0 +1,214 @@
+import type { SetupPermission, SetupPermissionScope } from "./permission-model.js";
+import { SETUP_PERMISSIONS } from "./permission-model.js";
+
+export const HARNESS_ACTIONS_SECRET_NAMES = [
+  "HARNESS_CONFIG_JSON_B64",
+  "LINEAR_API_KEY",
+  "CURSOR_API_KEY",
+  "HARNESS_GITHUB_TOKEN",
+] as const;
+
+export type HarnessActionsSecretName =
+  (typeof HARNESS_ACTIONS_SECRET_NAMES)[number];
+
+export const MANUAL_HARNESS_DISPATCH_REPO_PLACEHOLDER =
+  "<harness-dispatch-repo>";
+
+export function evaluateHarnessSecretPresence(
+  statuses: HarnessSecretStatusEntry[],
+): {
+  allPresent: boolean;
+  missing: HarnessActionsSecretName[];
+  unknown: HarnessActionsSecretName[];
+} {
+  const statusByName = new Map(statuses.map((entry) => [entry.name, entry.status]));
+  const missing: HarnessActionsSecretName[] = [];
+  const unknown: HarnessActionsSecretName[] = [];
+
+  for (const name of HARNESS_ACTIONS_SECRET_NAMES) {
+    const status = statusByName.get(name);
+    if (status === "present") {
+      continue;
+    }
+    if (status === "unknown") {
+      unknown.push(name);
+      continue;
+    }
+    missing.push(name);
+  }
+
+  return {
+    allPresent: missing.length === 0 && unknown.length === 0,
+    missing,
+    unknown,
+  };
+}
+
+export const TARGET_WORKFLOW_PATH =
+  ".github/workflows/trigger-harness-production-sync.yml";
+
+export type RemoteSetupStatus = "present" | "missing" | "unknown";
+
+export type RemoteWorkflowStatus =
+  | "present"
+  | "missing"
+  | "differs"
+  | "unknown";
+
+export type RemoteAccessStatus = "available" | "denied" | "unknown";
+
+export interface RemoteSetupActionDescriptor {
+  id: string;
+  label: string;
+  description: string;
+  permission: SetupPermission;
+}
+
+export const REMOTE_SETUP_ACTIONS = {
+  previewHarnessSecrets: {
+    id: "preview-harness-secrets",
+    label: "Preview harness repo Actions secrets",
+    description:
+      "Dry-run preview of harness repo GitHub Actions secret writes after confirmation",
+    permission: SETUP_PERMISSIONS.remoteRead,
+  },
+  applyHarnessSecrets: {
+    id: "apply-harness-secrets",
+    label: "Apply harness repo Actions secrets",
+    description:
+      "Write harness repo GitHub Actions secrets after explicit confirmation",
+    permission: SETUP_PERMISSIONS.remoteSecretWrite,
+  },
+  previewTargetWorkflowPr: {
+    id: "preview-target-workflow-pr",
+    label: "Preview target repo workflow PR",
+    description:
+      "Dry-run preview of target repo production sync workflow branch and PR install",
+    permission: SETUP_PERMISSIONS.remoteRead,
+  },
+  applyTargetWorkflowPr: {
+    id: "apply-target-workflow-pr",
+    label: "Apply target repo workflow PR",
+    description:
+      "Create or update a target repo branch and PR for the production sync workflow",
+    permission: SETUP_PERMISSIONS.remoteRepoWrite,
+  },
+} as const satisfies Record<string, RemoteSetupActionDescriptor>;
+
+export interface HarnessSecretStatusEntry {
+  name: HarnessActionsSecretName;
+  status: RemoteSetupStatus;
+}
+
+export interface HarnessSecretWritePlanEntry {
+  name: HarnessActionsSecretName;
+  action: "create" | "update" | "skip";
+  source:
+    | "generated-config-b64"
+    | "operator-input"
+    | "preserve-existing"
+    | "missing-input";
+}
+
+export interface RemoteHarnessSecretPreview {
+  actionId: string;
+  harnessDispatchRepo: string;
+  harnessDispatchRepoResolved: boolean;
+  harnessDispatchRepoSource: string;
+  repoAccess: RemoteAccessStatus;
+  secretStatuses: HarnessSecretStatusEntry[];
+  secretWritePlan: HarnessSecretWritePlanEntry[];
+  secretKeyNames: HarnessActionsSecretName[];
+  fingerprint: string;
+  permission: SetupPermission;
+  manualInstructions: string[];
+  validationError?: string;
+}
+
+export interface TargetWorkflowPrPlan {
+  repoConfigId: string;
+  targetRepoSlug: string;
+  harnessDispatchRepo: string;
+  productionBranch: string;
+  workflowPath: string;
+  branchName: string;
+  prTitle: string;
+  prBody: string;
+  workflowStatus: RemoteWorkflowStatus;
+  directProductionBranchWrite: false;
+}
+
+export interface RemoteTargetWorkflowPreview {
+  actionId: string;
+  plan: TargetWorkflowPrPlan;
+  repoAccess: RemoteAccessStatus;
+  workflowPreviewSummary: string;
+  fingerprint: string;
+  permission: SetupPermission;
+  manualInstructions: string[];
+  validationError?: string;
+}
+
+export interface RemoteHarnessSecretApplyResult {
+  actionId: string;
+  harnessDispatchRepo: string;
+  writtenSecrets: Array<{
+    name: HarnessActionsSecretName;
+    status: "created" | "updated";
+  }>;
+  skippedSecretNames: HarnessActionsSecretName[];
+  fingerprint: string;
+  permission: SetupPermission;
+}
+
+export interface RemoteHarnessSecretManualCopyValues {
+  values: Partial<Record<HarnessActionsSecretName, string>>;
+  missing: HarnessActionsSecretName[];
+}
+
+export interface RemoteTargetWorkflowApplyResult {
+  actionId: string;
+  harnessDispatchRepo: string;
+  repoConfigId: string;
+  outcome:
+    | "already-installed"
+    | "pr-created"
+    | "pr-updated"
+    | "branch-updated";
+  branchName: string;
+  prUrl?: string;
+  directProductionBranchWrite: false;
+  fingerprint: string;
+  permission: SetupPermission;
+}
+
+export function assertRemoteSetupPermissionScope(
+  actual: SetupPermissionScope,
+  expected: SetupPermissionScope,
+): void {
+  if (actual !== expected) {
+    throw new Error(
+      `Remote setup action requires permission scope "${expected}", received "${actual}"`,
+    );
+  }
+}
+
+export function assertRemoteSetupConfirmed(confirmed: boolean): void {
+  if (!confirmed) {
+    throw new Error("Remote setup writes require explicit confirmation");
+  }
+}
+
+export function assertRemoteSetupFingerprint(
+  provided: string,
+  expected: string,
+): void {
+  if (!provided) {
+    throw new Error("Preview fingerprint is required");
+  }
+  if (provided !== expected) {
+    throw new Error(
+      "Preview fingerprint is stale. Regenerate preview before applying.",
+    );
+  }
+}

package/workspace-snapshot/files/src/setup/remote-apply-actions.ts

@@ -0,0 +1,390 @@
+import {
+  collectRemoteSecretInputs,
+  redactKnownSecretValues,
+  sanitizeSetupActionResult,
+} from "./redact-secrets.js";
+import type {
+  GitHubRemoteSetupProvider,
+  HarnessSecretWriteRequest,
+} from "./github-remote-provider.js";
+import {
+  sanitizeGitHubSetupError,
+  sanitizeGitHubWorkflowSetupError,
+} from "./github-remote-setup-live.js";
+import {
+  formatHarnessDispatchRepo,
+  resolveHarnessDispatchRepo,
+} from "./harness-dispatch-repo.js";
+import {
+  generateHarnessConfigJsonB64,
+  previewHarnessSecretSetup,
+  readValidatedConfigLocalBytes,
+  type HarnessSecretOperatorInput,
+} from "./harness-secret-setup.js";
+import {
+  REMOTE_SETUP_ACTIONS,
+  assertRemoteSetupConfirmed,
+  assertRemoteSetupFingerprint,
+  assertRemoteSetupPermissionScope,
+  type HarnessActionsSecretName,
+  type HarnessSecretWritePlanEntry,
+  type RemoteAccessStatus,
+  type RemoteHarnessSecretApplyResult,
+  type RemoteHarnessSecretPreview,
+  type RemoteTargetWorkflowApplyResult,
+  type RemoteTargetWorkflowPreview,
+} from "./remote-actions.js";
+import { previewTargetWorkflowSetup } from "./target-workflow-setup.js";
+import { SETUP_PERMISSIONS } from "./permission-model.js";
+
+export interface RemoteHarnessSecretPreviewOptions {
+  cwd?: string;
+  operatorInput?: HarnessSecretOperatorInput;
+  manualHarnessDispatchRepo?: string;
+  provider?: GitHubRemoteSetupProvider;
+}
+
+export interface RemoteHarnessSecretApplyOptions
+  extends RemoteHarnessSecretPreviewOptions {
+  confirmed: boolean;
+  fingerprint: string;
+}
+
+export interface RemoteTargetWorkflowPreviewOptions {
+  cwd?: string;
+  repoConfigId: string;
+  targetRepo: string;
+  productionBranch: string;
+  manualHarnessDispatchRepo?: string;
+  provider?: GitHubRemoteSetupProvider;
+}
+
+export interface RemoteTargetWorkflowApplyOptions
+  extends RemoteTargetWorkflowPreviewOptions {
+  confirmed: boolean;
+  fingerprint: string;
+}
+
+function sanitizeRemotePreviewText(
+  text: string,
+  secrets: readonly string[],
+): string {
+  return redactKnownSecretValues(text, secrets);
+}
+
+async function buildHarnessSecretWriteRequests(input: {
+  cwd?: string;
+  operatorInput?: HarnessSecretOperatorInput;
+  secretWritePlan: HarnessSecretWritePlanEntry[];
+}): Promise<{
+  requests: HarnessSecretWriteRequest[];
+  skippedSecretNames: HarnessActionsSecretName[];
+  knownSecrets: string[];
+}> {
+  const requests: HarnessSecretWriteRequest[] = [];
+  const skippedSecretNames: HarnessActionsSecretName[] = [];
+  const knownSecrets = collectRemoteSecretInputs(input.operatorInput);
+
+  for (const entry of input.secretWritePlan) {
+    if (entry.action === "skip") {
+      skippedSecretNames.push(entry.name);
+      continue;
+    }
+
+    if (entry.name === "HARNESS_CONFIG_JSON_B64") {
+      const { bytes } = await readValidatedConfigLocalBytes(input.cwd);
+      const encoded = generateHarnessConfigJsonB64(bytes);
+      knownSecrets.push(encoded);
+      requests.push({ name: entry.name, value: encoded });
+      continue;
+    }
+
+    const operatorValue =
+      entry.name === "LINEAR_API_KEY"
+        ? input.operatorInput?.linearApiKey
+        : entry.name === "CURSOR_API_KEY"
+          ? input.operatorInput?.cursorApiKey
+          : input.operatorInput?.githubToken;
+
+    if (!operatorValue?.trim()) {
+      skippedSecretNames.push(entry.name);
+      continue;
+    }
+
+    requests.push({ name: entry.name, value: operatorValue.trim() });
+  }
+
+  return { requests, skippedSecretNames, knownSecrets };
+}
+
+export async function previewRemoteHarnessSecrets(
+  options: RemoteHarnessSecretPreviewOptions,
+): Promise<RemoteHarnessSecretPreview> {
+  const harnessDispatchRepo = await resolveHarnessDispatchRepo({
+    cwd: options.cwd,
+    manualRepo: options.manualHarnessDispatchRepo,
+  });
+  const harnessDispatchRepoSlug = formatHarnessDispatchRepo(harnessDispatchRepo);
+
+  let repoAccess: RemoteAccessStatus = "unknown";
+  let secretStatuses = undefined;
+
+  if (options.provider && harnessDispatchRepo.resolved) {
+    repoAccess = await options.provider.checkHarnessRepoAccess(
+      harnessDispatchRepoSlug,
+    );
+    secretStatuses = await options.provider.listHarnessSecretStatuses(
+      harnessDispatchRepoSlug,
+    );
+  }
+
+  const preview = await previewHarnessSecretSetup({
+    cwd: options.cwd,
+    operatorInput: options.operatorInput,
+    manualHarnessDispatchRepo: options.manualHarnessDispatchRepo,
+    secretStatuses,
+    repoAccess,
+  });
+
+  const knownSecrets = collectRemoteSecretInputs(options.operatorInput);
+  const manualInstructions = preview.manualInstructions.map((step) =>
+    sanitizeRemotePreviewText(step, knownSecrets),
+  );
+
+  return {
+    actionId: REMOTE_SETUP_ACTIONS.previewHarnessSecrets.id,
+    harnessDispatchRepo: harnessDispatchRepoSlug,
+    harnessDispatchRepoResolved: harnessDispatchRepo.resolved,
+    harnessDispatchRepoSource: harnessDispatchRepo.source,
+    repoAccess,
+    secretStatuses:
+      secretStatuses ??
+      preview.secretWritePlan.map((entry) => ({
+        name: entry.name,
+        status: "unknown" as const,
+      })),
+    secretWritePlan: preview.secretWritePlan,
+    secretKeyNames: preview.secretWritePlan
+      .filter((entry) => entry.action !== "skip")
+      .map((entry) => entry.name),
+    fingerprint: preview.fingerprint,
+    permission: REMOTE_SETUP_ACTIONS.previewHarnessSecrets.permission,
+    manualInstructions,
+    validationError: preview.validationError
+      ? sanitizeRemotePreviewText(preview.validationError, knownSecrets)
+      : undefined,
+  };
+}
+
+export async function applyRemoteHarnessSecrets(
+  options: RemoteHarnessSecretApplyOptions,
+): Promise<RemoteHarnessSecretApplyResult> {
+  assertRemoteSetupConfirmed(options.confirmed);
+  assertRemoteSetupPermissionScope(
+    REMOTE_SETUP_ACTIONS.applyHarnessSecrets.permission.scope,
+    SETUP_PERMISSIONS.remoteSecretWrite.scope,
+  );
+
+  const preview = await previewRemoteHarnessSecrets(options);
+  assertRemoteSetupFingerprint(options.fingerprint, preview.fingerprint);
+
+  if (preview.validationError) {
+    throw new Error(preview.validationError);
+  }
+
+  if (!options.provider) {
+    throw new Error("GitHub token is required for remote harness secret writes");
+  }
+
+  if (!preview.harnessDispatchRepoResolved) {
+    throw new Error("Harness dispatch repo must be resolved before applying secrets");
+  }
+
+  const { requests, skippedSecretNames, knownSecrets } =
+    await buildHarnessSecretWriteRequests({
+      cwd: options.cwd,
+      operatorInput: options.operatorInput,
+      secretWritePlan: preview.secretWritePlan,
+    });
+
+  if (requests.length === 0) {
+    throw new Error("No harness repo Actions secrets are ready to write");
+  }
+
+  try {
+    const writtenSecrets = await options.provider.writeHarnessSecrets(
+      preview.harnessDispatchRepo,
+      requests,
+    );
+
+    const result: RemoteHarnessSecretApplyResult = {
+      actionId: REMOTE_SETUP_ACTIONS.applyHarnessSecrets.id,
+      harnessDispatchRepo: preview.harnessDispatchRepo,
+      writtenSecrets,
+      skippedSecretNames,
+      fingerprint: preview.fingerprint,
+      permission: REMOTE_SETUP_ACTIONS.applyHarnessSecrets.permission,
+    };
+
+    const serialized = JSON.stringify(result);
+    for (const secret of knownSecrets) {
+      if (serialized.includes(secret)) {
+        throw new Error("Remote apply result leaked secret material");
+      }
+    }
+
+    return result;
+  } catch (error) {
+    throw new Error(sanitizeGitHubSetupError(error));
+  }
+}
+
+export async function previewRemoteTargetWorkflow(
+  options: RemoteTargetWorkflowPreviewOptions,
+): Promise<RemoteTargetWorkflowPreview> {
+  const harnessDispatchRepo = await resolveHarnessDispatchRepo({
+    cwd: options.cwd,
+    manualRepo: options.manualHarnessDispatchRepo,
+  });
+
+  const initialPreview = previewTargetWorkflowSetup({
+    repoConfigId: options.repoConfigId,
+    targetRepo: options.targetRepo,
+    productionBranch: options.productionBranch,
+    harnessDispatchRepo,
+  });
+
+  let workflowStatus = initialPreview.plan.workflowStatus;
+  let repoAccess: RemoteAccessStatus = "unknown";
+  let productionBranchSha: string | undefined;
+
+  if (
+    options.provider &&
+    initialPreview.plan.targetRepoSlug !== "<invalid-target-repo>"
+  ) {
+    const status = await options.provider.checkTargetWorkflowStatus({
+      targetRepoSlug: initialPreview.plan.targetRepoSlug,
+      workflowPath: initialPreview.plan.workflowPath,
+      intendedWorkflowContent: initialPreview.workflowContent,
+      productionBranch: options.productionBranch,
+    });
+    workflowStatus = status.workflowStatus;
+    repoAccess = status.repoAccess;
+    productionBranchSha = status.productionBranchSha;
+  }
+
+  const preview = previewTargetWorkflowSetup({
+    repoConfigId: options.repoConfigId,
+    targetRepo: options.targetRepo,
+    productionBranch: options.productionBranch,
+    harnessDispatchRepo,
+    workflowStatus,
+    productionBranchSha,
+  });
+
+  return {
+    actionId: REMOTE_SETUP_ACTIONS.previewTargetWorkflowPr.id,
+    plan: preview.plan,
+    repoAccess,
+    workflowPreviewSummary: preview.workflowPreviewSummary,
+    fingerprint: preview.fingerprint,
+    permission: REMOTE_SETUP_ACTIONS.previewTargetWorkflowPr.permission,
+    manualInstructions: preview.manualInstructions,
+    validationError: preview.validationError,
+  };
+}
+
+export async function applyRemoteTargetWorkflow(
+  options: RemoteTargetWorkflowApplyOptions,
+): Promise<RemoteTargetWorkflowApplyResult> {
+  assertRemoteSetupConfirmed(options.confirmed);
+  assertRemoteSetupPermissionScope(
+    REMOTE_SETUP_ACTIONS.applyTargetWorkflowPr.permission.scope,
+    SETUP_PERMISSIONS.remoteRepoWrite.scope,
+  );
+
+  const preview = await previewRemoteTargetWorkflow(options);
+  assertRemoteSetupFingerprint(options.fingerprint, preview.fingerprint);
+
+  if (preview.validationError) {
+    throw new Error(preview.validationError);
+  }
+
+  if (preview.plan.directProductionBranchWrite !== false) {
+    throw new Error("Direct production branch writes are not allowed");
+  }
+
+  if (!options.provider) {
+    throw new Error("GitHub token is required for target workflow PR install");
+  }
+
+  try {
+    const applyResult = await options.provider.applyTargetWorkflowPr({
+      targetRepoSlug: preview.plan.targetRepoSlug,
+      productionBranch: preview.plan.productionBranch,
+      branchName: preview.plan.branchName,
+      workflowPath: preview.plan.workflowPath,
+      workflowContent: (
+        await previewTargetWorkflowSetup({
+          repoConfigId: options.repoConfigId,
+          targetRepo: options.targetRepo,
+          productionBranch: options.productionBranch,
+          harnessDispatchRepo: await resolveHarnessDispatchRepo({
+            cwd: options.cwd,
+            manualRepo: options.manualHarnessDispatchRepo,
+          }),
+          workflowStatus: preview.plan.workflowStatus,
+        })
+      ).workflowContent,
+      prTitle: preview.plan.prTitle,
+      prBody: preview.plan.prBody,
+    });
+
+    return {
+      actionId: REMOTE_SETUP_ACTIONS.applyTargetWorkflowPr.id,
+      harnessDispatchRepo: preview.plan.harnessDispatchRepo,
+      repoConfigId: preview.plan.repoConfigId,
+      outcome: applyResult.outcome,
+      branchName: applyResult.branchName,
+      prUrl: applyResult.prUrl,
+      directProductionBranchWrite: false,
+      fingerprint: preview.fingerprint,
+      permission: REMOTE_SETUP_ACTIONS.applyTargetWorkflowPr.permission,
+    };
+  } catch (error) {
+    throw new Error(sanitizeGitHubWorkflowSetupError(error));
+  }
+}
+
+export function sanitizeRemoteHarnessSecretPreview(
+  preview: RemoteHarnessSecretPreview,
+  knownSecrets: readonly string[] = [],
+): RemoteHarnessSecretPreview {
+  return {
+    ...preview,
+    manualInstructions: preview.manualInstructions.map((step) =>
+      sanitizeRemotePreviewText(step, knownSecrets),
+    ),
+    validationError: preview.validationError
+      ? sanitizeRemotePreviewText(preview.validationError, knownSecrets)
+      : undefined,
+  };
+}
+
+export function toSanitizedRemoteSetupActionResult(
+  preview: RemoteHarnessSecretPreview,
+  knownSecrets: readonly string[] = [],
+) {
+  return sanitizeSetupActionResult(
+    {
+      actionId: preview.actionId,
+      outcome: "preview",
+      permission: preview.permission,
+      reason: preview.secretKeyNames.length
+        ? `Would write secret keys: ${preview.secretKeyNames.join(", ")}`
+        : "No harness repo secrets would be written",
+      manualInstructions: preview.manualInstructions,
+    },
+    knownSecrets,
+  );
+}

package/workspace-snapshot/files/src/setup/remote-preview-fingerprint.ts

@@ -0,0 +1,37 @@
+import { createHash } from "node:crypto";
+import type { SetupPermissionScope } from "./permission-model.js";
+
+function hashValue(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+
+export interface TargetWorkflowFingerprintInput {
+  actionId: string;
+  permissionScope: SetupPermissionScope;
+  repoConfigId: string;
+  targetRepoSlug: string;
+  harnessDispatchRepo: string;
+  productionBranch: string;
+  workflowPath: string;
+  branchName: string;
+  workflowContentHash: string;
+  productionBranchSha?: string;
+}
+
+export function computeTargetWorkflowFingerprint(
+  input: TargetWorkflowFingerprintInput,
+): string {
+  const normalized = {
+    actionId: input.actionId,
+    permissionScope: input.permissionScope,
+    repoConfigId: input.repoConfigId,
+    targetRepoSlug: input.targetRepoSlug,
+    harnessDispatchRepo: input.harnessDispatchRepo,
+    productionBranch: input.productionBranch,
+    workflowPath: input.workflowPath,
+    branchName: input.branchName,
+    workflowContentHash: input.workflowContentHash,
+    productionBranchSha: input.productionBranchSha ?? "",
+  };
+  return hashValue(JSON.stringify(normalized));
+}